TOP Si:CRt:TvCQM}?<T.‘V>iOrORN 

NATIONAL SECURITY AGENCY 
CENTRAL SECURITY SERVICE 

PORT GEORGE G. MEADE, MARVUANO 20785-6000 

23 February 2009 

MEMORANDUM FOR THE CHAIRMAN, INTELLIGENCE OVERSIGHT BOARD 

THRU: Assistant to the Secretary of Defense (Intelligence Oversight) 

SUBJECT: (U//rOUO) Report to the Intelligence Oversight Board on NSA Activities - 
INFORMATION MEMORANDUM 

(U//FOUO) Except as previously reported to you or the President, or otherwise stated in 
the enclosure, we have no reason to believe that any intelligence activities of the National Security 
Agency during the quarter ending 31 December 2008 were unlawful or contrary to Executive 
Order or Presidential Directive and thus should have been reported pursuant to Section 1.7.{d) of 
Executive Order 12333. 
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(U//FOUO)" The Inspector General and the General Counsel continue to exercise oversight 
of Agency activities by inspections, surveys, training, review of directives and guidelines, and 
advice and counsel. These activities and other data requested by the Board or members of the staff 
of the Assistant to the Secretary of Defense (Intelligence Oversight) arc described in the enclosure. 


> 0(1(1 fi 


GEORGE Ej/LARD 
Inspector General- '', , 




t 




VITO T. POTF.NZA 
General Counsel 


(U.7 FOUO) I concur in the report of the Inspector General and the General Counsel and 
hereby make it our combined report. 

KEiQl ^ALl£X/G^R 
Lieutenant General, U. S. Army 
Director, NSA/Chief, CSS 


Enel: 

Quarterly Report 


This document may be declassified and marked 
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upon removal of enclosures) 

Derived From: NSA/'CSSM 1-52 
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1. (U//F0U0)'Intelligence, counterintelligence, and intelligence-related activities 
that violate law, regulation, or policy substantiated during the quarter, as well as 
actions taken as a result of the violations. 

(U) Intelligence Activities 


( I S SI,, RFL TO USA, FVEY) Unintentional collection against United States 
persons. This quarter, there \vere| [instances in which Signals Intelligence (SIGINT) 
analysts inadvertently targeted or collected communications to. from, or about U. S. persons 
while pursuing foreign intelligence tasking. All intercepts and reports have been deleted or 
(b) (i) destroyed as required by United States SIGINT Directive (USSID) SP0018. 

(%(3)-P..L. 86-36 (b)(3)-P.L. 86-36 

(U) Unauthorized Targeting (b) ( 3 )-i 8 use 798 

(b) (3)-50 use 3024(i) 

('Ui !il N Ft An NSA analyst wrongly tasked a U S. tel ephone number for collection on 

I I He assumed that the selector was foreign | | 

foreign intelligen ce target. This mistake w as found during a review of tasked selectors on 

| | The selector was detasked f I and the analyst was paired with a 

senior analyst for additional training. No collection resulted from this violation. < b > (U 

(b) (3)-P.L. 86-36 

(TS//S 1 //REL TO USA. EV EA^- | an NSA analyst improperly searched 

for information on | | NSA analysts to acquire translati on metrics for their p erformance 


appraisals. The violation was found by a database auditor! 
additional training to the analyst. The queries returned |_ 
the NSA database I I 


_Jwho provided 

results, which were purged from 


'(b) (1). 

(b)(3)-P.L 


■ fW/SfffNR |. _| an NSAj_ __| 

[ ^ mistakenly included the e-mail address of| |in a query list of targeted 

addres ses. The analyst noti ced his mistake the same day. and the query was terminated jwith no 
results! (b) (3) -P. L. 86-36 

- (b) (3)-50 use 3024 (i) 

(TS//S I //REL TO USA. FVEY) On two occasions, collection occurred whi le valid foreign targets 
were in the United States. In the first instance, detask ing was requested on l I 

I but the selectors were not removed | | 

All related collection was purged from NSA 

databases. I he second instance occurred! ~| Selectors were d eactivated !" I 

| but collection 

occurred before | | detasked the selecto rs. The intercepts were purged from an 

NSA database as they were identified beginning from | No 

reporting resulted from either violation. (b) (l) 

_ __ _.. (b) (3) -P. L. 86-36 

-(TS//SI/7MFf | NSA analysts learned of a[~ Collection 

violation. Analysts believe thatl I records occurred! 1 


latabases. 


he second instance occurre 


(b) (1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 USC 3024(i) 


(b) (1) 

(b)(3)-P.L. 86-36 
(b) (3)-18 USC 798 
(b)(3)-50 USC 3024(i) 


Derived From: NSA/CSSM 1-52 
Dated: 20070108 
Declassify On: 39480914 
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Unfortunately, all related collection was purged from NSA databases in 2004. 

The details of the violation are still being researched. The NSA/CSS Office of the Inspector 

General (OIG) will track this action and report the results. .(t>) (l) 

. (b)(3)-P.L. 86-36 

| an NSA analyst learned that ] | foreign targets were 
_ Jhe United States| [ targe ted e-mail se lectors were detasked. 

l an d collection| | was purged from an 

When confirming the detaskingl |the ana lyst found that the 

The cause of the 


(TS//SI//RCL) On 


NSA database, 
selectors had not been removed from[ 


proble m was software-related. The s electors were removed [ 
No collection result ed because 


J had not been conducted from 


(U) Database Queries 


(b) (1) 

(b) (3)-P.L. 


86-36 


(b)(1) 

(b)(3)-P.L. 86-36 
(b) (3)-50 USC 3024 <i! 


(S//S 1 //REL TO USA. FVEY) On | l occasions. NSA analysts constructed poor database queries. 
ln | | ofthe| [occasions, collection resulted from the overly broad or incomplete queries. All 
resulting collection was deleted The remaining | [incidents did not result in collection. No 
reports were issued 

(TS//S 1 //REL TO USA. EVEY) Additionally. on | [ occasions. NSA analysts failed to verily that 
targets were located outside the United States befo re conducting database queries. ln| |of the 
linstances. the oversights resulted in collection. I I 



All queries were terminated and when collection occurred, the data was deleted. 

No reporting occurred. (b) (l) 

(b) (3)-P.L. 86-36 
(b) (3)-18 USC 798 
(b) (3)-50 USC 3024 (i) 


(U) Detasking Delays 


-(TG//Gl//Nf1~A valid foreign target traveled to the United States and | _ , 

before the tamet's selector was detasked. A detaskinu request was submitted 

-[- E -1,,* 


on 


United States. The detasking did not occur untilj] 


_after the target returned 

overseas. This violation was caused by an inefficient process fo r detaskinu. To lessen the 


risk of future violation s of this type, analysts are now required to[_ 

1 Collection associated with this violation was purged from NSA 
databases ! ~ 


(b) (1) 

(b)(3)-P.L. 86-36 
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b) (1) 

•7 (b) (3) -P. L. 86-36 


(U) Destruction Delays 


(S SI RF1 TO I SA F Vk V ) Hnm:in error caused aQ-day delay in deleting | 

from an NSA database.)__ an NS A analyst submitted a purge request with 

the intent of deleting col lection from| ~| He mistakenly believed that the request 

would effect pu ruing for | I was deleted from the) 

_when the mistake was found. 

(3//S1//REL TO USA. rVTY) Unintentional dissemination of U.S. identities. There 
were I I instances in which S1G1NT analysts disseminated communications to. from, or about 
U.S. persons while pursuing foreign intelligence tasking this quarter. All data have been deleted 
or destroyed as required by USS1D SP0018. In 1 |of the| [instances. SIGINT products were 
cancelled because they contained the identities of U.S. persons, organizations, or entities (b) T^ 
reports were either not reissued or were reissued with proper minimization. (k) (3 )_p.l. 86-36 

(b)(3)-18 USC 798 

(S//S1// N F) | | an NSA analyst included information from SIGINT about a 

I [ o the 

NSA | | although. within NSA. the | E snot part of the 

SIGINT prod uction chain. Additionally, the same unminimized and u nevaluated traffic was 
forwarded to I 1 assigned to NSA. The (b)(3)-P.L. 86-36 

| f ivas not authorized to receive un minimized and unevalu ated SIGINT. In both 

instances, the disseminated data was destroyed _ 


(TS//S1//NF) Before obtaining U.S. identity release ! ~| an NSA analys t 

e-mailed a briefing that included identities of a U.S . | l and U. S | |to th e 

| | later that month. \ _ I 

when the analyst recognized the mis take, she directed dest ructi on of the bri ef by the I 

as she applied for an identity release| The| | had no record ot the 

e-mailed briefing to destroy. '""'(b)( 1 ) 

_ (b)(3)-P.L. 86-36 

.. (S/ . S 1 7RELT0 USA. rVEV t T the name of a U.S. person was included 

-C3 -mail tips to elements inside and outside the SIGINT Production Chain. The violation 
was recognized the same day. The e-mails were recalled and a destruction notification was 
forwarded to all addressees. 

-ff 3//3 1//REL TO USA, P rfeYfj ~| an NSA analyst includedl |l '.S 

P erson l _ , L 

J _ | me NbA analyst forwarded | I 

| the analyst noticed that he had not minimized the U.S. identifiers. He 
directed and confirmed the destruction of the chans bvl I 


(b)(1) 

(b)(3)-P.L. 86-36 


(b)(1) 

(b)(3J-P.L. 86-36 
(b) (3)-18 USC 798 
(b)(3)-50 USC 3024(i) 


j 
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(U) The Foreign Intelligence Surveillance Act (FISA) 
(U) Business Records Order 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 USC 3024(i) 


(TS/7S1/7RCL TO USA. r\TV ) ~On 28 October 2008. an NSA analyst accessed Business Record 
FISA (BRFISA) data for | [ telephone selectors without authorization. The violation occurred 
because the analyst used an old version of the navigation software ) ~] 


The analyst updated the navigation software on 9 December 2008. and 


other analysts were reminded to update their software. No data was retained, and no reports 
were issued. (b)( 1 ) 

(b)(3)-P.L. 86-36 


(TS//SI//REL TO USA. PVEY ) On 31 October 2008. 
passed a mistyped phone nu mber to an NSA analystf 


resulted in the targeting of an 


The one digit change 


3 November 2008 until 5 Janu ary 2009, All related call c haining results 


Inumber in Business Records FISA data from 

were 


purged on 5 January 2009. and 


on 6 January 2009. 


f-P.L. 86-36 
(b)(3)-18 USC 798 
(b)(31-50 USC 3024(i) 


(T3//3I//NFfOn 15 December 2008. an NSA analyst improperly accessed BRFISA data for a 

U S. telephone number. Although the number was associated with a foreign target, it had not 

been approved for call chai ning in the BRFISA data. The analyst did not know that approval 

must be sought for BRFISA| | call chaining. No data was retained, and no reports wdP&1) 

issued. “ *■ (b)(3)-P.L. 86-36 

(b)(3)-50 USC 3024(i) 


(U/ /rOUO )~ Although the following violation occurred during the January through March 2009 
reporting timeframe, the incident is significant enough to warrant early reporting. 


4TS//SI//N F) On 15 January 2009. the Department of Justice reported to the FISA 
Court (FISC) that NSA had been using an “alert list” to compare incoming 
BRFISA metadata against phone numbers associated with counterterrorism 
targets that NSA had tasked for SIGINT collection. Although the Agency had 
reported to the Court that the alert list consisted of numbers for which NSA had 
determined that a reasonable articulable suspicion (R AS) existed that th e numbers 
were related to a terrorist organization associated with| 


Tb)(1) 

(b)(3)-P.L. 86-36 

the vast majority of selectors on the alert list had not been (b) ( 3 >-50 use 3024 (u 


subjected to a RAS determination. The circumstances surrounding this incident 
are still under research. The NSA/CSS OIGwill track this action and report the 
results. 


(U) Pen/Trap Order 

(U) Nothing to report. 

(U) The Protect America Act (PAA) 

(U) Nothing to report. 
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(U) The FISA Amendments Act 


7 (by:<3).-P.L. 86-36 


(S//SI//NO A target selector was not detasked du ring a target's | | visit 

to the United States. __an NSA analyst reque sted detasking of the 

target's e-mail selector on I I The selector was remove d I I 

I I but the analyst ) detasking process 

inadvertently omitted the request as he processed I I 


□ Resulting collection was purged from the NSA databases. No reporting occurred/!?) o 


-P.L. 86-36 


3)-50 USC 3024(i) 


~ fFSf/SI//REL TO USA. r\TY) During a tasking record review!_ | NSA 

analysts learned that a targeted selector had been tasked under the wrong authority. This due 
diligence found that the analyst mistakenly sel ected FISA Amend ments Act (FAA) 

| [ Cer tification instead o f the FAA | Certifi cation. No collec tion 

occurred between ! - | when the selectors were tasked and | when 

the selector was detasked. and no reports were issued 


31-P.L. 86-36 


(TS/ZSI/ZRE fc- TO - USA. FVEY) A target with U S and! bitizenship was inc orrectly tasked 
under the FAA ~| Certification | in violation of 

FAA section 702. A US. person may not be tasked pursuant to section 702 of the Act. The 
NSA analyst did not notice the target' s dual citizens hip when the e -mail selector was tasked. 

Resulting collection was purged from |NSA databases | 

I A software 

processing error prevented the deletion of the data ! ... (b) ( i ) 

jib) (3J-P.L. 86-36 

-fTG//GI//NEFl an FAA-authori zed target was active on a n e-mail address 

___ Collection was purged from | | NSA databases on 

1 but a software pr ocessing error preve nted the deletion of the data from 

_ The problem was i solated ! 1 and the data was purged from the 

| To ensure no other purging requ ests were affected, the 
system administrators re-processed all purging requests dating back to| | 


(TS//S1//N EH_ I an FA A-tasked e-mail account selector associated with 

| ~| the United States. The selector was not detasked 

until! b ecause of a database software proble m, which was correcte d on (b)(; 

| The target selector to be detasked was in the | Related 

collection was purged from NSA databases [ [ No reporting 

occurred. .. (b) (U 

(b) (3)-P.L. 86-36 


(b)(3)-P.L. 86-36 


NSA analysts learnt; 


elector 


an NSA analyst requested detasking of the target's e-mail selector on 


(b)(1) 
(b)(31- 
lb) (31- 
lb) (3) - 


| The analyst submitted the detasking request, b ut failed to 
notify the detasking otiice| |and the need to bypass the st andard! 1 

detasking process. R esulting collection was purged from the NSA databases on | | 

| No reporting occurred. 


(b)(i.j 

(b)(31-P.L. 86-36 


P.L. 86-36 
18 USC 798 
■50 USC 3024 (i) 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 USC 3024(i) 
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(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 USC 3024(i) 


an NS A analyst learned that an e-mail selector tasked for 
Certificate did not meet the FAA tasking standards. 


(T3//3I//NO _ 

collection under the FAA| 

The selector was detasked 
process has been changed to reduce the risk of future mistakes. Applicable selectors are now 

No collection or reporting occurred 


] As a result of this incident, the tasking 


4 G//01//N ffOti 


I an NSA analyst detasked a telephone selector of a target 
active in the United States, but failed to j 

The process failure was corrected on I 


was identified. Collection was purged from NSA databases on 


Jwhen the oversight 


J 


■ (T ' SMSR/REL TO USA. EVEY) Hu ma n error resulted in collection of a target's communic atio ns 
while he was in the United States from I M I 


The second error occurred when a| 


analyst 


pioted the targe t as outside the United States. 


All related collection was purged from NSA databases 


(b)(3)-P.L. 86-36 
(b)(3)-50 USC 3024(1) 



(TS//S I //R . EL TO USA. FVEY) Human error caused H I day detasking delay, which resulted 
in collection while the target selector was active in the United States The request to terminate 
the FAA-auth orized collection was submitted on I ~1 but the selector was not 

detasked until | | The analyst left on | j and did not return until_ 

at which time the selector was detasked. and the resulting collection was purged from a NSA 
database on I 


No reporting occurred on the unauthorized collection. 


(U) Other 

(U) Unintentional Dissemination 


b)(3)-P.L. 86-36 

(b) (3)-P.L. 86-36 


(b)(1) 

(b)(3J-P.L. 86-36 
(b)(3)-18 USC 798 
(b)(3)-50 USC 3024(i) 


(S//S1/ /RELTO USA rVCV tf 


1 


an NSA analyst e-mailed FISA-collected 
who was not authorized to receive the FISA data. U S. person information 


data to_ 

was not included in the e-mail. The analyst who misunderstood information sharing policy, 
confirmed the destruction of the data by the! 
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(b)!3!-T 


= a;g-3'6 


terminated 


Xb)(1) 

f±>) (3)-P.L. 86-36 
(I)(3)-50 USC 3024(i) 


Human error resulted in the targeting of ] | e-mai l selectors from I 

Although the s electors were removed fro in | | 

| NSA analysts did not annotate that the selectors were 

I Consequently. the | ^ electors remained active l~ 
I All collection related to the targets was destroyed, and no reports were issuecT 


(TS//Sl//N ff Another hum an error resulted in the targeting of ] | e- mail selectors from| I 

I I Although the selectors were removed from f. . | 

I I NSA a nalysts did not annotate that the selectors were 

terminated! ] Consequently, the ! S electors remained active ! | 

| | All collection related to the targets was destroyed, and no reports were issued. 

(bun 

(b> f.3> — P. L. 86-36 

(U) Computer Network Exploitation (b)iA>-i8 use 798 

(b) (3).-50 USC 3024 (1) 





(U) Counterintelligence Activities 

(b)(1) 

(U) Nothing to report. 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-18 USC 798 
(b)(3)-50 USC 3024(i) 
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(U) Intelligence-related Activities 


b) (1) 

b)(3)-P.L. 86-36 
b)i3)-50 USC 3024(i) 


(S//SI//NF) To reduce the risk of unauthorized telephony collection and prevent violations. 
NSA/CSS instituted a process to give analysts greater and faster insight into a target's location 



TBTtH::. 

(b)(3)-P.L. 


When collection occurred, it was purged from NSA databases. 


.L. 86-36 
(b)(3)-50 USC 3024(1) 


186-36. 

(TG//3I//N F ) 1 


L 


NSA/CSS analysts found that| |e-mail selectors 


Jthis quarter. No collection occurred 


(b)(1) 


(CZ/RCL TO USA. FV’CV) Although not violations ofE.O. 12333 and related directives. ' ( i - H6 - 36 
NSA/CSS reports [^instances in which database access was not terminated when access was 
no longer required. Once identified, accesses were revoked. In another instance, a work 
study employee was issued a database account in error. Accounts are only to be granted to 
analysts on a need-to-know basis, which was not the case with the high school work study 
employee. The student had not received training, and it was not activated before the account was 
terminated. The Branch Chief who authorized the account was counseled on the importance of 
understanding work roles before submitting individuals for database accounts. 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 USC 3024(i) 


(TS//3I//REL TO USA. f\TV) [ 


ns7[ 


_ was inappro priately forwarded to | _ 

analysts f [ failed to follow NSA policy and guidance for dissemination of SIG1NT 

tech nical information and sent the data to the non-SIGlNT analysts. The recipients destroyed the 


data[ 


.. 

(b)(3)-P.L. 86-36 


(TS//S1//REL TO USA. PVEV) [ 


analyst wrongfully ^shared his NSA Network ( NSA Net) a ccount password with another SIGINT 


analyst assigned to[ 


sha re his NSANet for training purposes. 
thel 


The[_|analyst mistakenly believed he could 

The analyst was relieved of his duties and transferred to 


(TS//S1//REL TO USA.-F¥E¥ »[ 


]the Officer-i n-Charge (01C) of a 


NT 


forwarded unminimized and unevaluated SIGINT to all-source analysts outside the SIGI 
production chain. The data did not contain U S. person information. An analyst at Fort Gordon 
recognized the mistake. The e-mail was recalled, and destruction of the data was confirmed by 
telephone. The QIC completed refresher training on SIGINT dissemination. 


(T - S//S I //REL TO USA. FV feA-[ 
learned that af 


^analyst sought and 


(b)(3)-P.L. 86-36 


(b)(1) 

(b)(31-P.L. 86-36 
(b)(3)-50 USC 3024(i) 
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(b)(3)-P.L. 86-36 

I d atabase access through his former NSA/CSS 
had determined that | | database access was not needed in the analyst's 


received NS A 
organization. The 

job. After three unsuccessful attempts to gain database access through the normal request 
process, the analys t contacted his former duty stat ion and was sponsored for access on 
I [ database access was terminated! 1 Additionally, from 

1 found f " .' r'frX 1 > 


J analyst and 


Janalysts sponsored for£ 


datab ase access by an organization not authorized to sponsor ac cess within the 
area of operational responsibility. Database access for the | l analysts was 


(b)(3)-P.L. 86-36 


terminated pending proper sponsorship. 


(TS/ZS l- Z/flCL TO USA. - F¥E -¥) Last quarter NSA reported ;[ Iproblem with thef 


causing the retention of U S. p erson! 
Jodification was added to extend^ 


The NSA Office of General Counsel has provided retention guidance to the affected 
organizations. 


Imalftm ctioned. and the 
[information. 


(b)(1) 

(b)(3)-P.L. 86-36 
(b)(3)-50 USC 3024(i) 


2. (U/ff OUCH NSA/CSS OIG Intelligence Oversight Inspections, Investigations, 
and Special Studies. 

(U//E OUO) During this quarter, the OIG reviewed various intelligence activities of the 
NSA/CSS to determine whether they had been conducted in accordance with applicable statutes. 
Executive Orders. Attorney General procedures, and Department of Defense and internal 
directives. With few exceptions, the problems uncovered were routine and showed that 
operating elements understand the restrictions on NSA/CSS activities. 


(U//FOU^) 


(b)(3)-P.L. 86-36 


(U/ /FOUO ) A joint inspection found that the] 
communicated processes. The focus of the 


would benefit from documented and 
Intelligence oversight program has been 


E.O. 12333 training, but not local incident handling procedures. Intelligence oversight training 
for newcomers is at an 86 percent compliance rate, and 99 percent for annual E.O. 12333 
refresher training. Although collectors, analysts, and supervisors are aware of the restrictions on 
the collection, analysis, and dissemination of US. person information, local incident reporting 
standards, and internal controls to track newcomer training and the use of sensitive NSA 
databases are needed. The OIG will track corrective action through completion. 


NSA Office of 


(b)(3)-P.L. 86-36 


(U/'POUOf An inspection found that the intelligence oversight within NSA's Office of j 
|is appropriately managed and compliant with standing regulations. 
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(U/ /FQU O) Alleged Unauthorized Disclosure of Classified Information and Misuse 
of the United States SIGINT Service (USSS). 


(S//SI//REL TO USA. FVEY) The NSA/CSS OIG reported alleged unauth orized disclosure of 


classified information and misuse of the USSS last quarter. 


a Navy Cryptologist 


met with an uncleared Navy Family Readiness social worker and disclosed that he had targeted 
his ex-wife and other family members through his job. An OIG inquiry found no evidence to 
support the sailor's claim. 


(U) Congressional, IOB, and DNI Notifications. 


(U) Nothing to report. 

3. (U) Substantive Changes to the NSA/CSS Intelligence Oversight Program. 


(U) Nothing to report. 

4. (U) Changes to NSA/CSS published directives or policies concerning 
intelligence, counterintelligence, or intelligence-related activities and the reason 
for the changes. 

(U) Nothing to report. 

5. (U) Procedures governing the activities of Department of Defense (DoD) 
intelligence components that affect U.S. persons (DoD Directive 5240.1-R, 
Procedure 15) Inquiries or Matters Related to Intelligence Oversight Programs. 

(U) Nothing to report. 
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